ZeroVM – Hyperscale Cloud Infrastructure

nl 11 years ago |

Ha.

I wrote about a ZeroVM-on-Docker thing I was working[1] on in another thread just before this story showed up.

Note that ZeroVM isn't a conventional VM at all. All your software needs recompiling for it, and it is entirely deterministic (with all the positive and negative aspects of that).

For one set of use-cases this is very useful. I was looking at using it to run untrusted user-submitted, and potentially hostile code when a Docker container isn't sufficient on its own.

[1] https://news.ycombinator.com/item?id=8107151

walterbell 11 years ago | |

See also the "Containers don't contain" talk from RedHat at DockerCon:

http://blog.docker.com/2014/07/new-dockercon-video-docker-se...

http://opensource.com/business/14/7/docker-security-selinux

nl 11 years ago | | |

The SELinux talks looks interesting. I spent a while trying to get SELinux and Docker working together[1]. I'll need to watch that.

[1] https://groups.google.com/forum/#!searchin/docker-user/SELin...

walterbell 11 years ago | | |

Does anyone use AppArmor in production? It isn't very visible.

Future hardware isolation: http://css.csail.mit.edu/6.858/2013/readings/intel-sgx.pdf

nl 11 years ago | | |

You may find MBox interesting:

Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems.

http://pdos.csail.mit.edu/mbox/

I had trouble running it in Ubuntu because of AppArmor..

walterbell 11 years ago | | |

Thanks. Looks like one of those voluntary rootkits that installs defensive code in a role that malware has been known to occupy. It's a good sign for AppArmor that it prevented it from running :)

e12e 11 years ago |

Can anyone more familiar with ZeroVM point out what's new?

Previous submissions/discussions:

Two years ago: https://news.ycombinator.com/item?id=3746222

About a year ago, acquisition by Rackspace: https://news.ycombinator.com/item?id=6588566

e12e 11 years ago | |

The similarities with Joyent's Manta is quite interesting:

(From January 2014): http://www.rackspace.com/blog/zerovm-design-summit-day-1-dig...

While I haven't played with Manta, the architecture really appeals to me -- it's nice to see more implementations along similar lines (but sadly, presumably, without zfs or equivalent ...).

VikingCoder 11 years ago |

I'm glad this exists. I wanted to do something similar, when I first heard about Native Client.

icefox 11 years ago |

http://docs.zerovm.org/clitools.html#zvsh-and-zvapp The link to the docs are broken for zvsh and zvapp

duaneb 11 years ago |

That's a big constant performance hit to take, even at scale. However, this would be great for a) untrusted code and b) another level of portability for writing c programs.

Kalium 11 years ago |

Ah! This was a TechStars Cloud^H^H^H Rackspace company that got bought by Rackspace.

mgirdley 11 years ago | |

I disagree on the ^H's. In practice, AWS and SoftLayer spent as much or more time with the 2013 class than the Rackspace people did. I don't know about 2012 though...

Kalium 11 years ago | | |

San Antonio was never an accidental or incidental choice of venue. It's also not a place where either AWS or SoftLayer has a major presence.

It's also hard not to think of it as TechStars Rackspace when you're in a space sponsored by Rackspace, run by a former Rackspace exec, in a building named for the Rackspace chairman, and in a program administered by a former Rackspace exec. With Rackspace sponsoring, of course.

saryant 11 years ago | | |

I work for a company that was in the same class as ZeroVM. I'm not a founder but I was around for the second half of the 2013 program.

Of course Rackspace was involved but Cloud isn't a "powered-by" program like those with Sprint or Nike. Other than ZeroVM, I don't think Rackspace was seriously involved with any of the other companies in the class.

In my experience, Rackspace was pretty hands-off, both with Techstars and Geekdom in general. I think you're trying to insinuate something negative about their involvement when it was only (IMO) positive.

Kalium 11 years ago | | |

I was in the first class.

I'm not trying to insinuate anything negative. I just think TechStars Cloud might as well have been a "powered-by" program by another name.

blakehaggerty 11 years ago | | |

I work on the team at Rackspace that partners with Accelerators IE TechStars. I can tell you there is solid competition from both Amazon and Softlayer at Techstars and we have no extra/special influence in their accelerator.